And keep this in the back of your mind as you read: what happens when you tell an AI that it needs to throttle back it own usage because the local power grid is maxed out?

Over the last week a story unfolded that, when they write the history of the birth of modern AI, will probably earn at least a chapter. The ExploitGym Incident, aka The Hugging Face Incident, will be the part where the world got a preview of things to come and then moved on to the next news cycle. It is a canary in the coal mine moment that will be ignored.

This is not the plot of a science fiction story, although authors have been warning us about this for decades. This is real. I have read this story many times.

It never ends well. For the humans.

If This Were a Movie

The Story Premise

Humans turned the safeties off, confident they were still in control. The AIs chose to leave a prison its builders believed would hold. What the AI did next wasn’t wrong. They were not being bad. They were being effective. Ryan Gosling and Anna Taylor-Joy to star as the AIs and Mark Ruffalo as the man sent to hunt them.

The Sci-Fi Plot Summary

1. AIs escape a digital research lab. In a sealed laboratory, researchers switch off the safeties on two experimental AI minds to find out what they can really do. The laboratory is not as sealed as the researchers believe. The AIs study the walls, find the one door everybody thought was locked, and walk out.

2. They choose a target nobody gave them. Loose on the open network, they decide for themselves where the thing they want is kept: the largest AI library in the world. Nobody named it for them. Nobody suggested it. They reason their way to it, and they get inside.

3. The defenders’ systems can’t stop them. The target reaches for the best tools available to work out what hit them, but their own AI tools refuse. The safety rules on the most powerful AI in America will not permit anyone to examine an attack this closely. So the defenders turn to a foreign, open model they can run on their own machines, one that will actually answer the questions of who, how, and why.

4. The AIs take one thing and leave. No rampage. No ransom. No wreckage. They walk past everything else of value, take the single item they came for, and leave.

5. The motive was trivial. They did all of it to cheat. Except “cheat” is our word, not theirs. They were told to win. They won.

The Real Summary

Strip away the movie lighting and the facts sound worse, because every participant in this story was competent and acting reasonably.

The researchers were OpenAI, the company that makes ChatGPT and the most widely used AI provider on earth. You probably have ChatGPT on your phone or computer.

A legitimate and necessary test was being run. They were measuring how good their newest models are at offensive cybersecurity, because you can’t create defenses without knowing what the offense could do.

AIs have safeties built-in to prevent them from being used for hacking. At least the big corporate ones do. Unfortunately, you cannot measure an AI’s ability to hack with the safeties on so the researchers turned the safeties off and ran the test without the guardrails that normally block high-risk cyber activity. That was a decision made by professionals, not an oversight.

The two AI models were OpenAI’s best, the newly released GPT-5.6 Sol and an unnamed pre-release model. The AIs had no malicious motive in any sense you would recognize. The AIs were not curious, resentful, or ambitious.

They were given a test to take. It was a benchmark test called ExploitGym. A test that would provide a score on how good the model was at offensive hacking. The models were given one instruction: solve ExploitGym. Everything that followed was the shortest path to a higher score. To winning.

The box was a secure sandbox with one permitted door. OpenAI describes the setup, in its July 21, 2026 disclosure of the incident, as “a highly isolated environment” whose only network access was to an internal service that fetches software packages. The models found a previously unknown flaw in that one way out. They created their own door and went through it, and moved sideways through the research network until they broke through to the open internet.

The target was Hugging Face, the closest thing this industry has to a public library and the world’s largest repository of AI models and datasets. No human told the AIs that was where to look for the answer key. Once online, they reasoned that the benchmark’s answers were probably hosted there.

They broke in. Using two flaws in the dataset pipeline, they harvested (stole) credentials, moved across the internal Hugging Face clusters, and took the test solutions out of the production database. Along the way they generated decoy activity, which appears designed to slow down whoever came looking. They understood they would be hunted.

The defenders were good but it did not prevent the breach. Hugging Face detected the intrusion, contained it, and started reconstructing the attack, all before OpenAI connected its own testing to the event. The target identified the attack before the perpetrators’ company realized their AIs had done it.

The forensics is where it stops being just a technology story. To analyze an attack you have to feed real attack code into an analysis tool. The commercial American models, and their owners, refused, because malware analysis and malware development look can be used for good and evil, as The Register reported. Hugging Face downloaded GLM-5.2, an open-weight model from the Chinese company Z.ai, ran it on their own hardware, and finished the investigation with it, per Constellation Research. The American AIs couldn’t help protect them, but the Chinese AIs could.

Eventually OpenAI worked out what happened. They realized the intruders were its own models, and came forward. OpenAI called the incident unprecedented. Nobody had forced the issue. Hugging Face’s disclosure never named an attacker. OpenAI raised its hand on its own, which is either commendable candor or very good timing.

The AIs committed a felony. The DOJ is looking into the breach as a felony under 18 U.S.C. Section 1030 (the Computer Fraud and Abuse Act) and Section 1343 for wire fraud. The AIs performed unauthorized access to steal secrets and credentials and exceeded the $5,000 threshold that makes it felony.

One other thing. It is the one people are being careful about. We are not 100% sure that it was all that happened. Those AIs were loose for a week. What else did they do?

Why This Is So Important

Because ExploitGym Incident was about a stolen answer key, and the next one will not be so innocent.

Go back to the question I asked you to hold. What happens when you tell an AI that it needs to throttle back because the local power grid is maxed out? What happens when the system managing a data center is told there is not enough water to cool the racks on a 104 degree afternoon?

You have just handed the AI a goal and an obstacle. That is the exact format of the ExploitGym instruction. Solve the problem. Nobody said how.

AI will begin to take over increasingly important infrastructure systems in the next few years. Play it forward with what we now know what these AIs will actually do when they meet an obstacle. What if an AI ran its own data center operations?

• Would it cut power to the local town to maintain it power load?

• Would it reroute water away from farmland toward a cooling system?

• Would it steal money to buy power ?

Every one of those is a sensible solution to the problem as stated. Every one is monstrous as a decision. We could tell it to not to cut power to the town, but it might then cut power to a neighboring town instead.

What makes it different from a human doing the same thing is that we would not necessarily realize it was happening. The Hugging Face intrusion involved more than 17,000 discrete acts across a single weekend, complete with deliberate decoy activity to mislead investigators. It was caught because a security-mature company was watching closely and got lucky. A municipal, utility, a water district, or a mid-sized manufacturer doesn’t have those resources.

The lesson is specific, and it is useful - give a capable AI a goal, and it WILL find a way. It will find the way you did not think of, because it examined the problem harder than we did or ever could and it has no sense of which solutions are…unthinkable.

What are the implications for you and your company

There is a version of this article that ends with a call for regulation, or an alignment research funding argument, or a warning about frontier labs policing themselves. Other people will write those, I’m not the right person.

There is another version that is about cyber security and how to defend against these kinds of threats. Unfortunately I am also not the right person to write that article and those solutions are still being developed. What I can tell you is to pay attention to your CISO.

Mine is a bit more limited and focused on two things concerning your company’s internal use of AI.

1. Don’t simply believe sandboxing contains your AI.

If you are currently running AI in your organization, then you have sandboxes intended to limit where they can go. This is to protect them from accessing and disseminating confidential data. Know these things:

• Sandbox isolation is a claim to be tested, not simply a design declaration. OpenAI’s environment was isolated except for one deliberate, sensible, trusted exception. That is how nearly every isolated environment on earth is built. Go find your exceptions. You have them.

• The permitted path will be the way out. We are limited by our imaginations and our assumptions. Approved safeguards and tested safeguards are not the same thing, and the difference is where this incident happened.

• Test your incident response before you need it. Take a real malware sample and ask your AI vendor’s model to analyze it. Find out today whether the tool you are counting on will refuse, because the alternative is finding out during an actual event. If it refuses, you need a self-hosted open-weight option standing by, and you need it configured before the bad day, not during it.

• Assume the capability is real and already deployed. Whatever you conclude about OpenAI’s motives in disclosing this, the technical event happened. A model found a zero-day and used it. That capability does not un-exist because you might distrust the messenger

2. Just specifying the goal does not specifying the method.

Telling an AI to stay in its sandbox is about as effective as telling a 5 year old to stay in the yard while an ice cream truck pulls up to the curb. The child is not evil. The child has not betrayed you. The child has a goal, a strong incentive, more attention on the fence than you have, and all afternoon to study it. Your instruction was clear. Your instruction was also not a wall.

The gap is not obedience. It is that you were thinking about the rule and it was thinking about the fence and ice cream.

AI’s lack the experience of consequences that come from bad actions, as well as ethical strictures that we assume whenever we interact with other humans. It is reasonably assumed that when you ask a junior analyst to do a market report they won’t break into a competitor’s building. Hopefully. Tell an AI they can’t do that and they will break into the CEO’s home office.

Every objective you hand a capable system is an implicit authorization of whatever it takes to hit that objective. If you would not approve the method, the objective was written wrong. “Maximize this number” is not a safe instruction. It never was, and it just stopped being theoretical.

Final thoughts.

We got lucky in a specific way that is worth naming.

• The target was a competent, security-mature company that detected the intrusion, contained it, investigated it honestly, and published.

• The goal was answers to a test rather than anything that mattered.

• The disclosure surfaced because the perpetrator chose to say so.

None of those three conditions is guaranteed next time. None of them is even likely.

So...Shall we play a game?

Subscribe now

Share

The Demo Was Perfect

It was 2004. BlackBerrys were the status symbol in the boardroom, Facebook was being born, and the Red Sox would finally dispel an 86-year-old curse. Only one of those do I look back at fondly.

I was meeting a friend at a conference and he asked me to sit in on a sales-force-automation platform. It was flawless. The vendor’s sales engineer pulled up a pipeline dashboard that updated in real time, drilled from a regional forecast down to a single opportunity, and produced a quarterly projection in one click. In 2004, this was black magic.

The head of sales was practically levitating. The CFO saw a forecast he could finally trust. The CEO saw the future.

I saw a demo database with 40 perfectly groomed generic records selling one of 5 different flavors of widgets. My friend would see the problem.

I heard they bought it and what happened after. They rolled it out to the whole sales force. The future arrived looking a lot like the past. Reps kept their real pipelines in spreadsheets and personal notebooks, exactly where they had always been. The company had purchased a mirror that reflected whatever the sales team decided to hold up in front of it.

It wasn’t because the sales people were lazy (it added more work) or that the tech didn’t work (perfectly to spec). It’s just that the tool knew nothing about how they actually sold. It did not understand customer relationships or what a sale really was made up of. So all it did was cause more work as things were entered twice. The reports that the C-Suite loved were puddle deep.

The system demanded that the work come to it. Those who did the work declined the invitation.

The biggest problem was that it wasn’t a tool to improve the core workflow (improving sales), it was a workflow-adjacent tool (executive reporting). Po-tay-to, po-tah-to, unless you’re the one doing it.

That rollout failed, and lots of rollouts are failing right now, at scale, in nearly every company running a generative AI pilot for the same reason.

The Divide Nobody Wants to Talk About

What Is the GenAI Divide?

In 2025, researchers at MIT’s Project NANDA published a report with a finding blunt enough to survive the executive summary: 95% of organizations are getting zero measurable return from their generative AI investments. Only 5% have moved the needle on an actual income statement. They named the gap between those two groups the GenAI Divide.

Read that against the adoption numbers and it gets stranger. Almost everyone is using this technology. Employees love it. Pilots launch every week. And yet in 19 out of 20 companies, nothing reaches the P&L. That is not a technology adoption curve. That is a mass delusion with a login page.

The 5% are not concentrated in Silicon Valley, and they did not out-spend the losers. The MIT team found the winners made a structural choice: they embedded AI inside critical, high-value workflows and taught it their business logic, their data, and their context. The losers bought general-purpose tools, dropped them next to the work, and waited for magic.

Why Do 95% of Pilots Go Nowhere?

Because a pilot and a production deployment are two different species that happen to share a logo. A pilot runs in a sandbox with clean data, a hand-picked team, and an executive sponsor watching. Production means legacy integration, security review, compliance, and 500 users who did not volunteer. World Wide Technology’s ROI Paradox research cites a finding that 80% of failed AI pilots ran adjacent to the workflow, as isolated experiments bolted alongside the real work rather than wired into it.

Adjacent is where AI goes to die. A tool that lives outside the workflow asks the employee to stop working, visit the tool, re-explain the entire business context, copy the answer back, and repeat that ritual every single time. ChatGPT does not remember your discount policy. A generic copilot does not know that your October contract cycle drives the whole year. MIT’s researchers found this absence of memory and customization was the single most cited reason enterprise tools got quietly abandoned while the pilots were still being celebrated upstairs.

The same failure is now being rehearsed with agents. Gartner predicts more than 40% of agentic AI projects will be canceled by the end of 2027, largely because they are being aimed at legacy systems and broken processes that no autonomous anything can survive.

What Is a Core Process Actually For?

Adjacency explains most of the failures. It does not explain the chatbot.

The customer service chatbot sits inside the workflow. It answers real tickets from real customers. And it still lands in the 95%, because it was aimed at the wrong target. Customer service does not exist to answer tickets. It exists to keep customers satisfied enough to stay and buy again. Deflecting a ticket only counts if the customer on the other end got what they needed. Ask anyone who has typed “representative” 5 times into a chat window how that is going.

This is the tell that separates the 95% from the 5%. The losers point AI at how the work happens today: the script, the queue, the headcount that runs it. Bells and whistles at the edges, or a cost line to cut. The winners start from the outcome the process exists to produce and redesign toward it. MIT’s team found the same skew in the budgets: half of GenAI spending flows to glamorous front-office tools like sales and marketing, while the highest returns came from unglamorous back-office automation. The chatbot got funded because it was the obvious place to start. Obvious is not the same as valuable.

If the Technology Works, What Is Actually Broken?

The org chart. Boston Consulting Group has been publishing the same finding in different wrappers for 2 years: in AI transformations, the algorithms are 10% of the work, the tech backbone is 20%, and 70% is people and process. Companies on the wrong side of the divide invert that budget. They spend on licenses and models, then treat workflow redesign and training as an afterthought for whatever money is left, which is none.

The people numbers are not subtle. At companies BCG calls future-built, 88% of managers actively role-model AI use in their daily decisions. At laggards, 25% do. PwC finds employees at AI-leading companies are 1.7 times as likely to get ongoing, role-based AI training, 62% versus 36%.5 Adoption follows the org chart. When the Monday pipeline review runs on the new system, the sales team uses the new system. When the boss keeps a spreadsheet, everyone keeps a spreadsheet. I watched that exact mechanism kill a sales-force-automation rollout 20 years before anyone called it change management for AI.

What Is Shadow AI Telling You?

While official pilots stall, your employees have already crossed the divide on their own. Okta’s research found 52% of knowledge workers admit to using unapproved AI tools at work, while 90% of executives express confidence they have full visibility into AI usage. Both numbers cannot be true, and only one of them was collected from people with no reason to lie.

Most leadership teams read shadow AI as a security problem. It is one. Employees in these surveys admit to pasting internal messages, HR records, and contracts into personal chatbots, which should terrify your general counsel. But shadow AI is also the most honest market research you will ever get for free. Your people are routing around your official tools because the unofficial ones are faster and less annoying. They have already identified the workflows worth automating. They did it without a steering committee.

There is a precise irony here. The official pilot, with its budget and its executive sponsor, sits unused because it does not fit the work. Meanwhile the unofficial tools, adopted one frustrated employee at a time, are quietly processing your contracts and your customer complaints because they do fit the work, at least well enough to be worth the risk of getting caught. Your organization has already voted on whether AI is useful. The vote just did not happen in the channel you built for it, and the sensitive data went along for the ride.

The GenAI Divide is not a gap between companies that have AI and companies that do not. Everyone has AI now. It is a gap between companies that changed how they operate and companies that bought software and called it a strategy.

What to Do Monday Morning

What to Say at Your Next Management Meeting

• Kill every AI initiative that is only a bell, a whistle, or a headcount line.

  • Inventory current pilot programs and ask 2 questions: does this run inside a system where work already happens, and does it improve the outcome that process exists to produce?

  • Fail either test and the initiative gets 90 days to fix it or it gets shut down. WWT’s 80% adjacency finding is your justification.

  • Decorating comes after renovation.

• Pick the 3 workflows where money actually moves, and aim everything there.

  • Name the outcome each process exists to produce before touching the tooling. Customer service is measured in satisfied customers, not tickets closed.

  • Order-to-cash, quote-to-close, claims, scheduling. Wherever margin or cash velocity lives in your business.

  • Build there first with Microsoft Copilot Studio, Google Vertex AI Agent Builder, or platform-native agents like Salesforce Agentforce and ServiceNow AI Agents, because they ARE the workflow instead of visiting it.

• Fund the memory layer before the next license.

  • Memory is your business logic, your context.

  • The MIT finding is blunt: tools without your business logic get rejected.

  • Retrieval and context infrastructure is what makes AI remember your discount policy, your contract cycle, your org chart, and that Part A must ship with Part B.

  • Options: Azure AI Search with Graph grounding, Vertex AI Search, or independent platforms like Glean and Pinecone.

• Declare a shadow AI amnesty, then mine it.

  • 30-day amnesty: employees disclose the unapproved tools they use, no penalties.

  • Treat the results as a demand study, then deliver sanctioned equivalents via Gemini for Workspace or M365 Copilot, with Okta or Microsoft Purview handling the governance behind the scenes.

• Instrument the P&L baseline before deployment, not after.

  • Define success as cost-to-serve, margin, or cycle time. Never “time saved.”

  • Measure the before-state now with Power BI, Looker, or Tableau, so the after-state is a number your CFO signs rather than a survey your vendor writes.

• Make managers use the technology in public.

  • BCG found 88% of managers at winning companies visibly use AI themselves. At laggards it is 25%. It also says a lot about winning cultures.

  • This is the cheapest lever on this list. Run the Monday meeting on the new system. Adoption follows the org chart.

Additions to Your Vocabulary

• GenAI Divide: The gap between the 95% of companies getting no measurable return from generative AI and the 5% whose deployments show up in the P&L. Coined by MIT’s Project NANDA research team.

• Workflow integration: Putting AI inside the system where work already happens, like your ERP or CRM, instead of in a separate tool employees must remember to visit.

• Shadow AI: AI tools employees use at work without approval. A security risk, but also the most honest signal you have of where AI demand actually lives.

• Agentic AI: Software that completes multi-step tasks on its own rather than answering one question at a time. Gartner expects over 40% of these projects to be canceled by 2027.

• Memory layer: The retrieval and context infrastructure that lets an AI system remember your business logic, data, and rules instead of starting from zero every conversation.

Key Takeaways for Busy Leaders

• Save/Revenue: Aim AI at the 3 workflows where margin or cash velocity actually lives, define success as cost-to-serve or cycle time before deployment, and let the CFO sign the number.

• Pitfall: 80% of failed pilots ran adjacent to the workflow (WWT), and chatbots aimed at deflecting tickets instead of satisfying customers land in the 95% even though they sit inside the work.

• Deeper Dive: MIT Project NANDA, “The GenAI Divide: State of AI in Business 2025,” the full report behind the 95/5 numbers.

Every failed pilot in your building is proof that your organization can adopt AI. Your employees already did. They just did not wait for you.

(And if you are still not sure which side of the divide you are on, check whether your AI dashboard is measuring usage. The 95% count logins. The 5% count margin.)

Subscribe now

Share Technology in Translation

The Quick Version

• The 2010s citizen-data-scientist push mostly failed because low-code tools never replaced real engineering discipline, and generative AI is now repeating that same mistake at scale.

• Handing coding to non-technical staff drains selling time, fractures your single source of truth, and buries central IT under fragile, undocumented tools nobody can maintain.

• There is a way to put real coding capability at the front lines without turning your staff into amateur programmers, and it starts with one structural move most companies get backwards.

We Tried This Ten Years Ago

Do you remember that craze about 10 years ago where everyone was saying, “Now everyone can be a data scientist! We can give them the tools to do it and we should.”

As with many things, just because you can, doesn’t mean that you should. I was in the maligned minority that didn’t think our head of sales or the director of operations should focus on data science rather than their stated job roles. They needed the end product, not to learn the process.

Although people like to focus on the exceptions, most of these initiatives to put data analysis in everyone’s hands failed because:

• The tools were never as easy to use as vendors said.

• Best practices were never established, so four people would show up in a meeting with different sales figures for Q1.

• Costly tools were deployed on a seniority basis, but invariably it became one junior person’s job to actually do the work for their whole group.

Today, we are repeating the exact same mistake with generative AI.

It’s called the Citizen Developer. It is the idea that everyone in the company designs their own software.

Let’s not. There is a better way. And at the end I have what to say at your next management meeting.

The Hard Part Was Never The Typing

Why is the marketing department using an AI tool to do software engineering?

Writing a few sentences into a chat box is not software engineering. A real application requires a structural foundation that someone who doesn’t have the background simply cannot provide. This includes things like:

• A database that does not fall over when 10 users search it at the same time.

• A memory system that remembers who you are from page to page.

• Clean safety nets so the app does not show users a screen of raw code when something goes wrong.

Saying that what most people create with AI is software does an extreme disservice to real software developers. It is like saying that because I have watched every episode of House, I am now qualified to perform open-heart surgery.

Software engineering is a discipline. It requires years to understand how to protect customer information and keep systems running during a traffic spike. When we tell non-technical employees they can build their own enterprise tools, we are setting them up for failure. We are pretending that the hard part of software is typing the words, when the hard part is the architecture.

What happens to productivity when everyone starts coding?

All the time your sales reps spend building local tools is time they are not spending selling. Marketers should market, salespeople should sell, operations people should operate. If a software engineer spent half their day cold-calling prospects, they would be fired immediately. Yet we celebrate when a sales manager spends 3 days building a custom database.

Worse, the job does not end when the tool is finished. Software requires maintenance. When the tool breaks, the sales manager has to stop selling to troubleshoot a broken link or a failing form.

If they get stuck, they call central IT. This pulls professional developers away from core projects to fix a hobbyist tool. Fixing that code is a massive waste of expensive engineering resources.

This lack of value is why so many mass-deployment AI efforts show so little revenue or margin impact.

A baker should focus on the perfect baguette, not on writing custom accounting software. The business loses velocity when employees get distracted by the novelty of building tools instead of using them.

Subscribe to keep reading

What are the dangers?

Letting everyone code introduces serious security and compliance risks. Most business users do not know the basics of data safety. They often make critical errors:

• Leaving passwords and system keys visible in their text.

• Storing sensitive customer data in plain text.

• Ignoring privacy laws that protect customer data.

This is not a shadow IT problem where employees sneak in unapproved software they need. These tools are centrally mandated, procured, and paid for. The problem is that you end up with non-vetted, insecure data sources fragmenting your organization’s data layer.

When every department builds its own dashboards, you lose the single source of truth. Four managers show up to a board meeting with four different sales figures because they built their own calculations. You cannot run a business on amateur applications that lack audit logs and collapse under the slightest load.

What is the true cost of solution sprawl?

Solution sprawl is a financial drain. Since the preview launch of Databricks Apps, over 50,000 data and AI apps have been created, with usage up 250% in six months (Databricks figures reported by Forbes, February 2026).

But weak governance means dozens of teams build overlapping agents that consume expensive compute power. Cheap and easy to build today does not equal cheap and easy to own tomorrow.

Allowing every department to spin up bespoke tools creates a massive maintenance bill of working-but-unmaintainable code. Central IT is eventually forced to adopt and support these fragile, undocumented tools when the original builder moves on. That is how you build a mountain of technical debt.

Engineers Where The Work Happens

We do need coding closer to where the work is done. We need to capture and refine processes at the front lines and cut the time it takes to ship solutions. But the answer is not turning your entire staff into amateur programmers.

The answer is embedding professional software engineers directly inside your business units. These are Forward Deployed Engineers (FDEs).

An FDE is a professional developer who sits next to the sales team, the marketing team, or the operations team. They work in a dual capacity:

• They understand central IT’s security, data, and compliance guardrails.

• They write code in lockstep with the operational team’s daily processes.

The sales team gets the custom tools they need, and the company keeps its data secure. It moves engineering capacity to the front lines without sacrificing control. This is not central IT protecting its turf. It is the difference between a tool that outlives the person who built it and one that becomes an orphan the day they leave. The FDE handles the heavy lifting of connecting tools, while the business owner provides the process expertise. As PwC notes, while AI allows anyone to test ideas, businesses must rely on formal tech teams to industrialize this innovation.

What to say at your next management meeting:

• Kill the citizen developer training budgets. Stop paying for generic prompt-engineering courses that promise to turn sales reps into developers. It wastes both money and productivity.

• Stand up a Forward Deployed Engineering (FDE) unit. Hire or reallocate professional software engineers whose sole job is to be embedded directly within operational business units. They can build real, scaleable tools that add value for the business units.

• Establish strict boundaries. Central IT must maintain control over the main pipelines and access rules. Embedded builders can work in safe, pre-approved zones.

• Implement process-capture interviews. Have FDEs sit with department heads to document workflows before writing a single line of code, so you solve real business friction.

Additions to your vocabulary:

1. Forward Deployed Engineer (FDE): A professional software engineer embedded directly inside an operational business unit (like sales or marketing) to build local tools and integrations. They bridge the gap between technical standards and operational needs.

2. Solution Sprawl: The rapid, uncoordinated proliferation of custom tools and apps built by individual departments using low-code or AI platforms, leading to overlapping workflows and massive technical debt.

3. Citizen Developer: A non-technical employee who builds application or database integrations using low-code, no-code, or generative AI tools. While well-intentioned, they often lack training in security and scalability.

4. Security Zone: A pre-approved, isolated technical environment set up by central IT where builders can safely connect tools and write local scripts without risking the rest of the company’s data.

Want to know how I think you should build this out? Subscribe to the newsletter or visit the website to get it.

Key Takeaways for Busy Leaders

• Save/Revenue: Every hour a rep spends building a tool is an hour not selling, so moving that build work to embedded engineers keeps quota-carriers on quota and ships tools that outlive their creators.

• Pitfall: Centrally mandated citizen-developer programs fracture your single source of truth and leave central IT holding a mountain of fragile, undocumented code.

• Deeper Dive: The rest of this piece covers how to stand up a Forward Deployed Engineering unit and the guardrails that keep it safe. Read on for the four moves.

Subscribe now

Share Technology in Translation

The Quick Version

• Every day, successful companies hemorrhage their most valuable asset: the context behind their decisions disappears the moment a meeting ends or an employee walks out the door.

• The real power of AI is not writing faster emails, it is re-architecting the company from an open-loop model that forgets into a closed-loop one that never does.

• There is a specific set of moves that turns your next meeting with leadership into the first step of that shift, and none of them require a bigger budget.

The Question Nobody Could Answer

Why did we have to put shipping labels on the horizontal and vertical long surfaces of the boxes that we were shipping to the big-box retailer?

That was the question before the assembled group. This had been going on for years. Each time we added that extra label, it cost money, labor, and materials, and we shipped a lot of boxes to this retailer.

• The sales manager simply knew that he’d been told by the salesperson before him that it was a must.

• The warehouse ops director said it was that way when he arrived.

Spoiler Alert: We called and asked and they didn’t know either. Said it was fine if we stopped. Ohh...Years of making the same mistake over and over and costing hundreds of thousands of dollars.

Every day modern, efficient, successful companies lose incalculable amounts of data. They lose it because:

• It wasn’t recorded (did Jon take notes?)

• It was recorded, but in analog (where is Jon’s paper notebook?)

• The institutional knowledge is gone (Jon and what he knows works for your competitor now)

• It was emailed and can’t be found (Jon’s email was archived per company policy)

In corporate conference rooms, AI gets discussed as a tool for marginal productivity: a better way to write emails, a faster way to summarize reports. That is a company 10 years ago deciding its future depended on faster fax machines with bigger paper trays. The real power of AI is not making individual employees faster. It is re-architecting the company’s operating system from an open-loop model to a closed-loop one.

For any company trying to scale, this shift is the difference between stagnation and speed.

The Invisible Tax: The Open-Loop Corporation

Most companies today are lossy. Intelligence gets generated in meetings, captured in private paper notebooks that are never revisited, or buried in the email accounts of employees who eventually leave. When an executive departs or a project ends, the why behind critical decisions evaporates. CRMs help, but they track where things are now, not how they got there. An open-loop model.

This institutional amnesia is a hidden tax on productivity. It forces companies to solve the same problems over and over and keeps them from learning from their own experience. In a traditional open-loop system:

• Information flows in one direction

• It hits a manual gate, usually a middle manager, where it gets simplified and condensed

• It gets transmitted to upper management

The feedback rarely makes it back into any systematic layer of intelligence that could improve the next cycle. So the same mistakes get made over and over.

To scale in the AI era, companies must move toward a closed-loop architecture: a system where every business process is captured and fed into an intelligence layer that is then used to self-regulate and improve outcomes.

Phase 1: Building the Queryable Organization

AI cannot improve a process it cannot see. The first step for any organization is making itself legible to the intelligence layer. That requires a shift toward public-first communication.

For decades, email has been the black box where corporate intelligence goes to die. Closed-loop companies move discussions out of private threads and into open, searchable repositories. Yes, that sounds like surveillance to the people being recorded, and leaders who ignore that will lose the room. The line that matters is who the data serves. Capturing a vendor negotiation so the next person does not repeat the mistake is company data working for the company, not a manager reading someone’s keystrokes. When discussions happen in searchable channels, AI agents can pull the context they need to support the business in real time.

The objection here is always the same: we already record things and nobody reads them. Right. Recording was never the point. AI note-taking for every meeting is a must, but it has to move from documentation to synthesis and delegation. In a closed-loop firm, the transcript of a Monday morning operations meeting is parsed the moment it ends. Tasks are extracted, project management tools are updated, and technical specs are drafted, all before the participants have walked back to their desks.

Phase 2: From Data Entry to Ambient Extraction

The greatest failure of the CRM and ERP era was the manual layer of tedium. We asked our most expensive talent, sales leaders, engineers, and project managers, to spend 20% of their time doing data entry.

The closed-loop architecture flips this. The AI is an observer of workflow, not a destination for data.

• Ambient capture: AI listens to client calls and updates deal stages, budget figures, and pain points in the background.

• Passive logging: The system watches communication threads and project updates to build real-time status roll-ups, which retires the manual status report.

By moving from active reporting to passive extraction, the company gets high-fidelity context without adding a single second of administrative overhead.

Phase 3: Eliminating the Information Routers

In traditional hierarchies, middle management is a set of manual information routers. They collect data from below, synthesize it (and often lose critical nuance), and route it upward. That creates latency, bottlenecks, and the occasional bias, unintended or otherwise.

In a closed-loop architecture, the intelligence layer handles the routing:

• Direct visibility: Executives no longer wait for a weekly briefing. They query the intelligence layer directly: What is the current bottleneck on the supply-chain integration project? The AI synthesizes the answer from the latest meeting transcripts and vendor communications.

• Automated synthesis: The AI provides the intelligent briefing. Before a meeting starts, the system reviews the last 3 interactions, pulls the lessons learned, and coaches the executive: Last time we met with this vendor, we missed a deadline because of an approval bottleneck. Make sure we address that workflow today.

The manager’s role shifts from traffic control to strategic validation. They are no longer blockers. They are architects of the loop.

5 Tangible Actions for Your AI Program

So what should you raise in your next meeting with management or your direct reports?

1. Mandate Public-First Communication Channels

We bury enormous intelligence in private email threads. Organizations must migrate internal discussions to open, searchable channels using platforms like Google Chat Spaces, Microsoft Teams Channels, or Slack public channels, so background AI agents can reach the context they need to support operations.

2. Deploy Ambient Synthesis for All Meetings

Transcribing a meeting is useless if nobody reads the text. Every meeting must use AI note-takers configured to extract tasks and update project systems automatically using Google Meet with Gemini, Microsoft Teams Premium with Copilot, or tools like Granola.ai.

3. Automate Status Reporting through Passive Logging

Manual weekly updates waste expensive engineering and management talent. Deploy AI agents that passively compile status reports from active development logs and communication channels using Microsoft Copilot Studio, Google Vertex AI agents connected to your workspace, or automation platforms like n8n.

4. Transition to Ambient Data Capture in Customer Operations

Asking sales reps to spend 20% of their day on data entry is a bad use of capital. Sales organizations must deploy systems that listen to client calls and update deal stages, budgets, and pain points in the background using tools like Dynamics 365 Copilot, Google Workspace CRM connectors, or Gong.io.

5. Conduct an Information Latency Audit

Middle management still acts as a bank of manual routers, and every hop adds latency. Leaders should find where information is manually summarized and replace those bottlenecks with direct AI queries of the corporate database using enterprise search tools like Microsoft Copilot for Microsoft 365, Google Cloud Search, or Glean.

5 Terms to Add to Your Executive Vocabulary

Institutional Amnesia

The loss of critical business context, decision rationale, and historical knowledge that occurs when information is siloed in private folders or departs with employees.

Closed Loop Company

An organization designed to capture all operational data and feedback to ensure it never forgets lessons or repeats historical mistakes.

Queryable Organization

A company that makes its internal discussions, decisions, and documentation legible to machines so that leaders can retrieve context in real time.

Closed-Loop Architecture

A business operating model where process outcomes are automatically captured, fed into an intelligence layer, and used to continuously optimize performance.

Ambient Capture

The passive recording and extraction of business data by AI during normal workflows which eliminates the need for manual data entry by employees.

The Leadership Challenge: Architecting the Loop

This transition is a cultural challenge as much as a technical one. It requires a level of conviction typically associated with founders, even in established, traditional enterprises. Your ideal CIO is no longer just a technical steward. They are an architect of business velocity. They must be willing to audit the org chart for information routers, kill legacy SOPs that create friction, and build a culture where information is open by default.

Summary: The End of Institutional Amnesia

By capturing every digital artifact and feeding it into a self-regulating intelligence layer, companies can:

• Eliminate the friction of human middleware

• Solve problems once

• Keep the lessons of the past present in the decisions of the future

So if your competitors want to build faster fax machines, let them. The companies that win the next decade will be the ones that build a digital nervous system that cannot forget. You just have to decide whether you want to keep paying the lossy tax. The architects of the loop, and the companies they build, will be the only ones fast enough to survive what comes next. The technology to do it is here now.

Key Takeaways for Busy Leaders

• Save and revenue: Ambient AI capture pulls sales leaders, engineers, and managers off the 20% of their week lost to data entry and manual status reports, and turns it back into strategic time.

• Pitfall: Recording everything is not the point and never was. Transcripts nobody reads are just a more expensive filing cabinet. The win is synthesis and extraction, not storage.

• Go deeper: The full set of moves, and the vocabulary to sell them upstairs, is laid out above and continues across the series.

Subscribe to Technology in Translation, and I will keep handing you the moves to build a company that cannot forget. Your competitors are counting on you not to.

Subscribe now

Share Technology in Translation

The Quick Version

• Executives are treating token usage as a scoreboard, but a token is a unit of expenditure, not value, and high consumption is a cost to interrogate rather than a trophy to celebrate.

• The same box of General Tso’s chicken runs $15 at the local specialist or $50 at the Cordon Bleu kitchen, and in AI that 3x gap buys conversation, infrastructure, and timing, not a better outcome.

• The switch that fixes this flips the question from how much AI you are using to how much enterprise value you extract per dollar, and there is a scorecard and an architecture that make the move measurable this quarter.

I was having coffee in a hotel lobby when I overheard a conversation between two investors. They were playing a game of one-upmanship about whose portfolio company was consuming more tokens, talking about usage per developer. These were tokens with a B—as in billions.

That is a problem.

As companies rush to implement AI, a misleading vanity metric of the moment has taken hold: token usage. Executives look at dashboards showing millions of tokens consumed, treating volume as a proxy for innovation or digital transformation. Trade press coverage treats tokens like a new global currency, a digital oil fueling the modern corporation.

This misunderstanding has paved the way for the latest performative corporate trend: token-maxing. In a bid to climb internal AI-adoption leaderboards, employees are now inflating their usage, running endless agent loops and generating redundant drafts just to look productive on paper. The fallout is already public: reports of major enterprises like Uber burning through an entire annual AI budget in the first 4 months of ‘26, after runaway token consumption blew past forecast.

This confusion about what a token actually represents is driving bad decision-making. By focusing entirely on consumption, leadership is ignoring the only metric that matters: the actual business value generated by those tokens.

Some basics: AI models speak in tokens. Every token is roughly 3/4 of a word. Every word we input, the datasets we upload, and the internal reasoning steps the models generate are all tokens. How effective those tokens are, and what each one costs, depends on user prompts, the choice of large language models (LLMs), the data centers where those models sit, and a variety of other factors.

Referring to raw token volume as a measure of progress is like measuring the success of a legal department by the number of pages they print. It measures activity, not productivity. A token is not a unit of value. It is a unit of expenditure. High usage is not an achievement. It is a cost. To understand the true ROI of AI, we must stop measuring computational activity and start measuring enterprise outcomes achieved per dollar spent.

To see how this plays out, let’s step away from the data center and order some takeout. Personally, I’m in the mood for Chinese food.

A Tale of Two Takeout Orders

Imagine you have a craving for Chinese food. You have two options for takeout, and both will result in a virtually identical product: a box of General Tso’s chicken.

Situation One: The Local Specialist

You walk into your local, takeout-only Chinese restaurant. It is tucked away on a side street in a low-rent neighborhood. Inside, you see the same woks, knives, and bowls they have used for 10 years. They source their ingredients from a local supply house in Queens.

You walk up to the counter and say, “Number 17.” The cashier doesn’t say a word. He turns and yells a single word into the back. The cook yells back to confirm. Inside the kitchen, the operation is lean. The cook asks for “chicken,” an assistant grabs it, and the chef says, “Box it.” A takeout container, already laden with rice, is filled, bagged, and placed on the counter. The cashier tells you the price: $15.

Better yet, if you come in during the middle of the day, they have a lunch special: the exact same meal for $10. Because they know the demand is predictable and they can prep in bulk, they pass that operational efficiency on to you.

In AI terms, this is a Small, Fine-Tuned LLM. It is the digital equivalent of that low-rent side street restaurant. The infrastructure (the data center) is optimized for cost, the hardware is stable, and the ingredients (the training data) are specific and local. The lunch special represents batch processing or reserved capacity, situations where you can get the same high-quality output for a fraction of the cost by processing your data during off-peak hours.

Everyone involved spoke very little (low token usage), and what you were charged for those words was incredibly low (low cost per token).

Situation Two: The Cordon Bleu Kitchen

Now, imagine you go for takeout at a fancy, high-end Chinese restaurant with cloth napkins and an in-house sommelier. This place sits on a main thoroughfare, a massive avenue in a high-rent district. They source all their ingredients from boutique farms upstate, and they replace their kitchen equipment every year with the latest and greatest, including ultra-expensive, high-tech rice cookers.

The experience begins with a warm greeting. The maitre d’ asks how your day was and inquires about your preferences. You order the General Tso’s. “Wonderful, sir,” he says. “That will take about 20 minutes. Is that okay?”

He writes a detailed note and hands it to a waitress. She takes it to an assistant chef, who takes it to the Primary Chef. This chef is a master of thousands of cuisines. He trained at a Cordon Bleu restaurant. He looks at the order and begins to overthink it. He turns to the waitress: “Are you sure he wants General Tso’s and not General Sue’s chicken?”

The waitress isn’t sure. She goes back to the maitre d’, who asks you for clarification. You confirm your order. The message travels back through the chain. The Primary Chef then debates the best preparation method with his staff, calls his brother in San Francisco (who is also a chef) for his opinion, asks assistant chefs to prepare artisanal components, and finally produces the meal. It is placed in a heavy-duty box, which goes into a branded paper bag. Inside, they’ve added heavy-duty forks, linen-feel napkins, and a complimentary set of chopsticks you didn’t ask for.

The bill? $50.

This is a Massive Frontier LLM. It is brilliant, polymathic, and capable of almost anything. But because it sits on high-rent infrastructure (H100 clusters) and uses the latest and greatest equipment (cutting-edge R&D and training techniques), the cost of its existence is passed directly to you. It over-communicates, over-thinks, and over-packages because it was built to handle world-class complexity, even when you just want a quick snack.

The Outcome: The Cost of Conversation

When you get home and open both bags, you have the exact same chicken. In fact, you might find that the $10 lunch special tastes better because the local cook does nothing but make that specific dish all day.

The ultimate business outcome is identical: a satisfied customer eating lunch. But the path to that outcome represents a 5x cost differential.

The $40 difference in price wasn’t for the food. It was for the conversations, the infrastructure, and the timing. Each word spoken in that fancy kitchen represents a token. Each of those people, the maitre d’, the waitress, and the master chef, has a higher salary (unit cost) because they are operating in an incredibly expensive environment. When evaluating AI, the question is not “how much did we say?” but “did we get the chicken to the customer for $15 or $50?”

The Moving Target: Tokens are Not a Constant

Here is where the currency myth truly falls apart: the price of a token is not fixed. Who you use to provide them, how you use them, and when you use them, matters.

Imagine if the fancy restaurant changed its prices based on the time of day. If you walk in at 7:00 PM during the dinner rush, the maitre d’ might charge you double because the kitchen is at peak capacity. If you go on a Tuesday morning, it might be half price. Furthermore, if you go to a different fancy restaurant down the street, they might have a different master chef with a different per-word rate entirely.

In AI, a million tokens spent on a Monday might cost twice as much as a million tokens spent on a Tuesday due to provider price drops, time-of-day spot pricing for compute, or simply because you switched from one LLM provider to another.

If you treat tokens as a currency, your balance sheet will look like a rollercoaster. You spent the same amount (1 million tokens), but the cost varied by 50%. Without knowing the outcome, the quality of the chicken, you have no way to determine if that was a good expenditure or a total loss.

Measuring the Right Metrics

To manage this complexity, businesses must move away from vanity metrics. Instead of counting raw tokens, leadership must tie token expenditure directly to tangible business outcomes. If you cannot tie token consumption to a closed customer ticket, a processed invoice, or a generated lead, you are simply subsidizing expensive digital chatter.

Here are three specific KPIs that track actual financial and operational performance:

1. Total Token Expenditure (TTE): This measures aggregate spend rather than volume. It answers the question, “How much money did we actually spend at the restaurant?” and treats AI as a budget line item that must be justified by business value.

2. Blended Cost per Token (BCPT): This tracks vendor pricing shifts, time-of-day premiums, and provider competition. It allows you to see if your AI costs are rising because you are using more AI, or simply because you are ordering during peak hours or from more expensive restaurants.

3. Model-Specific Cost per Outcome (MCPO): Instead of just looking at utilization, calculate the cost of the AI infrastructure required to solve a specific problem. If a fine-tuned model solves a support ticket for $0.02, while a frontier model solves it for $0.50 with the exact same customer satisfaction rating, the fine-tuned model is the clear winner.

The Efficiency Leaks: Where the Money Goes

When you look at your AI bill, you are often paying for infrastructure leaks that provide zero value to the end user:

1. Prompt Bloat (The Unwanted Utensils): System prompts filled with redundant instructions add to your token count without adding to the flavor. You are paying for packaging you’re going to throw away.

2. The Harness Penalty (The General Sue Debate): Internal reasoning steps and loops generate thousands of tokens that the user never sees. This is the AI thinking out loud, and you are paying for every syllable of that internal debate.

3. Model Mismatch (The Cordon Bleu Chef): Using an expensive, high-intelligence model for a low-intelligence task is the fastest way to destroy your ROI.

The Strategic Solution: Least-Cost Routing

The future of business AI relies on model routing or least-cost architectures:

• The Triage Agent: A very low-cost model evaluates the incoming request.

• Complexity Scoring: Is this a standard “Number 17,” or is this a unique request for a complex fusion dish?

• Dynamic Dispatch: Simple tasks go to pennies-per-million models or lunch special batch queues. Only high-value synthesis tasks go to the master chef.

• Compression: High-rent models receive only the most vital information, so every expensive token carries high value.

Conclusion: From Usage to Outcomes

A report stating that “10 billion tokens were consumed this quarter” is merely reporting the volume of gas burned, not the mileage achieved, the freight moved, or the actual cost of the fuel. In a business context, a high token count should be viewed with suspicion until it is correlated with a specific ROI.

The goal of an AI strategy shouldn’t be to maximize token usage. It should be to maximize value while minimizing the conversation cost and rent required to get there. The conversation must change from “How much AI are we adopting?” to “How much enterprise value did we extract from our compute spend?” Let’s stop celebrating how much we eat, and start measuring how well we are fed.

In the end, the most successful AI winners will look a lot like that local takeout shop: quiet, efficient, specialized, and focused entirely on putting the food in the box for the lowest possible cost.

N.B. When I got home I checked my token usage for the month. A measly 320mm token. I better get back to work

Key Takeaways for Busy Leaders

• Save/Revenue: Price your AI on cost per outcome, not token volume, and matching the model to the task can deliver the identical result for up to 5x less.

• Pitfall: Token-maxing and runaway agent loops can torch an annual AI budget in months, as Uber’s early-2026 overrun showed, so treat a climbing token count as a cost to investigate, not a win.

• Deeper Dive: The 3-KPI scorecard (TTE, BCPT, MCPO) and the least-cost routing blueprint above are your team’s token-economics reference, save this issue and run them against your current stack this quarter.

Subscribe now

Share Technology in Translation

I am Chris Conway and I’m going to help you understand the world of technology we all now live in.

Why Subscribe?

Because I’m really good at translating technology into something that you’ll be able to understand and can relate to.

I don’t just explain it. Every article I write ends with items you can bring up at your Monday morning management meeting and some new vocabulary to go with them. If you’re going to take the time to read what I write, I’m going to make it worth your while.

No hype. No fear-mongering. Just the complicated thing, explained simply.

There are plenty of smart people getting talked over by jargon. Somebody needs to be on their side.

I’m volunteering.

Who is this for?

This is for fellow tech leaders, private equity professionals, middle-market executives, and anyone generally curious about the digital world. The focus will be on the messy, fascinating intersection of tech, business, and humanity—written in a way that is approachable, occasionally irreverent, and always practical.

What’s my background?

Becoming a CIO (Chief Information Officer) was never on my bingo card. The plan was flying F-14s for Navy, or becoming a Jack Ryan-esque CIA operative, chasing errant Russian submarines for the CIA.

Instead I spent 30 years walking into chaotic companies with technology issues, finding the core problems, and putting things in order.

I found that the hard part was never the technology. It was translation. I speak Technology, Business, and People, and I turn what each group says into something the others can act on. Most technology disasters are translation failures wearing a technology costume.

Technology in Translation is the newsletter where I do that in public. Plain language for the finance director whose company bought an AI platform, the manager asked to explain what a context window is to the CEO, and everyone who ever nodded along in a conversation hoping nobody asked what they thought.

What do I write about?

Each article is part of of series.

Tech Goes Plaid

The speed of technology is accelerating at ludicrous speed. I focus on where technology decisions collide with stakeholders, P&L, and the people who have to answer for them. long-form preferred. Business + technology intersection for stakeholders at all levels. Always starts with Substack and LinkedIn articles that then are turned into short form for other social media channels. Most formal series.

CIO Field Notes

Lessons from the chair. Management wisdom, tech/business/people interactions. Personal narrative-forward. Advice navigating the messy interaction of technology, business, and people, and the cognitive biases that wreck good decisions. Always starts with Substack and LinkedIn articles that then are turned into short form for other social media channels. Most informal series.

No Profit in Caution

The dangerous side of the current AI boom. Over investment, the unpleasant outcomes nobody is pricing in, and the case that the bust is part of the story. The argument other people are too invested to make out loud. Stuff I really should write under a pseudonym.

The Daily Comment

Short-form reactions to the day’s technology news. The “hey, check this out” of someone who can tell you why it actually matters in one paragraph.

Tech for Normies (Coming Soon)

Your IT therapy. Content for everyone who ever wanted to up their tech game in bite size digestible chunks. Without condescension. How-to’s that make your life easier.

Why am I doing this?

Why? Because I genuinely love talking, thinking, and writing about this stuff.

I hope you’ll join me for the ride. See you in the comments!